Question 1

In which control should a cloud service provider, upon request, inform customers of compliance impact and risk, especially if customer data is used as part of the services?

Options :

A : Service Provider control

B : Impact and Risk control

C : Data Inventory control

D : Compliance control

Answer: A

Question 2

Which of the following is an example of financial business impact?

Options :

A :

A distributed denial of service (DDoS) attack renders the customer’s cloud inaccessible for 24 hours, resulting in millions in lost sales.

B : A hacker using a stolen administrator identity brings down the Software of a Service (SaaS)sales and marketing systems, resulting in the inability to process customer orders ormanage customer relationships.

C :

While the breach was reported in a timely manner to the CEO, the CFO and CISO blamed each other in public, resulting in a loss of public confidence that led the board to replace all

Answer: A

Question 3

Which of the following BEST ensures adequate restriction on the number of people who can access the pipeline production environment?

Options :

A : Ensuring segregation of duties in the production and development pipelines

B : Role-based access controls in the production and development pipelines.

C : Separation of production and development pipelines

D : Periodic review of the Cl/CD pipeline audit logs to identify any access violations

Answer: B

Question 4

With regard to the Cloud Controls Matrix (CCM), the Architectural Relevance is a feature that enables the filtering of security controls by:

Options :

A :

relevant architecture frameworks such as the NIST Enterprise Architecture Model, the Federal Enterprise Architecture Framework (FEAF), The Open Group Architecture Framework (TOGAF). and the Zachman Framework for Enterprise Architecture.

B : relevant architectural paradigms such as Client-Server, Mainframe, Peer-to-Peer, and SmartClientBackend

C : relevant architectural components such as Physical, Network, Compute, Storage, Application, and Data.

D :

relevant delivery models such as Software as a Service (SaaS), Platform as a Service (PaaS), Infrastructure as a Service (laaS).

Answer: D

Question 5

An auditor is reviewing an organization’s virtual machines (VMs) hosted in the cloud. The organization utilizes a configuration management (CM) tool to enforce password policies on its VMs. Which of the following is the BEST approach for the auditor to use to review the operating effectiveness of the password requirement?

Options :

A :

The auditor should not rely on the CM tool and its settings, and for thoroughness should review the password configuration on the set of sample VMs.

B :

Review the relevant configuration settings on the CM tool and check whether the CM tool agents are operating effectively on the sample VMs.

C :

As it is an automated environment, reviewing the relevant configuration settings on the CM tool would be sufficient.

D :

Review the incident records for any incidents relating to brute force attacks or password compromise in the last 12 months and investigate whether the root cause of the incidents was due to in appropriate password policy configured on the VMs.

Answer: B

Confidently Practice Online with Free CCAK Exam Cram

Buying Options: